Read the docs
TI-2014-00048 Aliases CVE-2014-0050GHSA-xx68-jfcg-xmmf

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat…

Priority HIGH 80CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Security bypass
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 22 fixed, 15 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835 and CWE-264.

Summary

MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended exit conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.83334 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial commons-fileupload:commons-fileupload (Maven): 1.3.1org.apache.tomcat:tomcat (Maven): 8.0.3, 7.0.52Red Hat: 14 advisoriesRed Hat: 22 fixed, 15 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—commons-fileupload:commons-fileupload (Maven)before 1.3.11.3.1Patch availableGHSA-xx68-jfcg-xmmf
—org.apache.tomcat:tomcat (Maven)8.0.0-RC1 to before 8.0.38.0.3Patch availableGHSA-xx68-jfcg-xmmf
—org.apache.tomcat:tomcat (Maven)7.0.0 to before 7.0.527.0.52Patch availableGHSA-xx68-jfcg-xmmf
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • commons-fileupload:commons-fileupload (Maven) Vendor— Affected before 1.3.1 Fixed in 1.3.1 Patch available GHSA-xx68-jfcg-xmmf
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 8.0.0-RC1 to before 8.0.3 Fixed in 8.0.3 Patch available GHSA-xx68-jfcg-xmmf
  • org.apache.tomcat:tomcat (Maven) Vendor— Affected 7.0.0 to before 7.0.52 Fixed in 7.0.52 Patch available GHSA-xx68-jfcg-xmmf

CPE configurations NVD · 74

CPEVersionsRoleVendor
cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:*12.0VulnerableOracle
cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:*12.0inVulnerableOracle
cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:*13.0VulnerableOracle
cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:*13.1VulnerableOracle
cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:*13.2VulnerableOracle
cpe:2.3:a:oracle:retail_applications:13.3:*:*:*:*:*:*:*13.3VulnerableOracle
cpe:2.3:a:oracle:retail_applications:13.4:*:*:*:*:*:*:*13.4VulnerableOracle
cpe:2.3:a:oracle:retail_applications:14.0:*:*:*:*:*:*:*14.0VulnerableOracle
cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:*up to 1.3VulnerableApache
cpe:2.3:a:apache:commons_fileupload:1.0:*:*:*:*:*:*:*1.0VulnerableApache
  • cpe:2.3:a:oracle:retail_applications:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:12.0in:*:*:*:*:*:*:* Versions 12.0in Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:13.0:*:*:*:*:*:*:* Versions 13.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:13.1:*:*:*:*:*:*:* Versions 13.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:13.2:*:*:*:*:*:*:* Versions 13.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:13.3:*:*:*:*:*:*:* Versions 13.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:13.4:*:*:*:*:*:*:* Versions 13.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_applications:14.0:*:*:*:*:*:*:* Versions 14.0 Vulnerable ·Oracle
  • cpe:2.3:a:apache:commons_fileupload:*:*:*:*:*:*:*:* Versions up to 1.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_fileupload:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Apache
Show 64 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:apache:commons_fileupload:1.1:*:*:*:*:*:*:*1.1VulnerableApache
cpe:2.3:a:apache:commons_fileupload:1.1.1:*:*:*:*:*:*:*1.1.1VulnerableApache
cpe:2.3:a:apache:commons_fileupload:1.2:*:*:*:*:*:*:*1.2VulnerableApache
cpe:2.3:a:apache:commons_fileupload:1.2.1:*:*:*:*:*:*:*1.2.1VulnerableApache
cpe:2.3:a:apache:commons_fileupload:1.2.2:*:*:*:*:*:*:*1.2.2VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:*7.0.0VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:*7.0.0 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:*7.0.1VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:*7.0.2VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:*7.0.2 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:*7.0.3VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:*7.0.4VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:*7.0.4 betaVulnerableApache
cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:*7.0.5VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:*7.0.6VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:*7.0.7VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:*7.0.8VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:*7.0.9VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:*7.0.10VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:*7.0.11VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:*7.0.12VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:*7.0.13VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:*7.0.14VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:*7.0.15VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:*7.0.16VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:*7.0.17VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:*7.0.18VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:*7.0.19VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:*7.0.20VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:*7.0.21VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:*7.0.22VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:*7.0.23VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:*7.0.24VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:*7.0.25VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:*7.0.26VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:*7.0.27VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:*7.0.28VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:*7.0.29VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:*7.0.30VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:*7.0.31VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:*7.0.32VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:*7.0.33VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:*7.0.34VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:*7.0.35VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:*7.0.36VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:*7.0.37VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:*7.0.38VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:*7.0.39VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:*7.0.40VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:*7.0.41VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:*7.0.42VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:*7.0.43VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:*7.0.44VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:*7.0.45VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:*7.0.46VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:*7.0.47VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:*7.0.48VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:*7.0.49VulnerableApache
cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:*7.0.50VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:*8.0.0 rc1VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:*8.0.0 rc10VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:*8.0.0 rc2VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:*8.0.0 rc5VulnerableApache
cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableApache
  • cpe:2.3:a:apache:commons_fileupload:1.1:*:*:*:*:*:*:* Versions 1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_fileupload:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_fileupload:1.2:*:*:*:*:*:*:* Versions 1.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_fileupload:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:commons_fileupload:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:*:*:*:*:*:*:* Versions 7.0.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.0:beta:*:*:*:*:*:* Versions 7.0.0 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.1:*:*:*:*:*:*:* Versions 7.0.1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.2:beta:*:*:*:*:*:* Versions 7.0.2 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:*:*:*:*:*:*:* Versions 7.0.4 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.4:beta:*:*:*:*:*:* Versions 7.0.4 beta Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.5:*:*:*:*:*:*:* Versions 7.0.5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.6:*:*:*:*:*:*:* Versions 7.0.6 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.7:*:*:*:*:*:*:* Versions 7.0.7 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.8:*:*:*:*:*:*:* Versions 7.0.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.9:*:*:*:*:*:*:* Versions 7.0.9 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.10:*:*:*:*:*:*:* Versions 7.0.10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.11:*:*:*:*:*:*:* Versions 7.0.11 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.12:*:*:*:*:*:*:* Versions 7.0.12 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.13:*:*:*:*:*:*:* Versions 7.0.13 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.14:*:*:*:*:*:*:* Versions 7.0.14 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.15:*:*:*:*:*:*:* Versions 7.0.15 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.16:*:*:*:*:*:*:* Versions 7.0.16 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.17:*:*:*:*:*:*:* Versions 7.0.17 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.18:*:*:*:*:*:*:* Versions 7.0.18 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.19:*:*:*:*:*:*:* Versions 7.0.19 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.20:*:*:*:*:*:*:* Versions 7.0.20 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.21:*:*:*:*:*:*:* Versions 7.0.21 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.22:*:*:*:*:*:*:* Versions 7.0.22 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.23:*:*:*:*:*:*:* Versions 7.0.23 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.24:*:*:*:*:*:*:* Versions 7.0.24 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.25:*:*:*:*:*:*:* Versions 7.0.25 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.26:*:*:*:*:*:*:* Versions 7.0.26 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.27:*:*:*:*:*:*:* Versions 7.0.27 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.28:*:*:*:*:*:*:* Versions 7.0.28 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.29:*:*:*:*:*:*:* Versions 7.0.29 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.30:*:*:*:*:*:*:* Versions 7.0.30 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.31:*:*:*:*:*:*:* Versions 7.0.31 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.32:*:*:*:*:*:*:* Versions 7.0.32 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.33:*:*:*:*:*:*:* Versions 7.0.33 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.34:*:*:*:*:*:*:* Versions 7.0.34 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.35:*:*:*:*:*:*:* Versions 7.0.35 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.36:*:*:*:*:*:*:* Versions 7.0.36 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.37:*:*:*:*:*:*:* Versions 7.0.37 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.38:*:*:*:*:*:*:* Versions 7.0.38 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.39:*:*:*:*:*:*:* Versions 7.0.39 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.40:*:*:*:*:*:*:* Versions 7.0.40 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.41:*:*:*:*:*:*:* Versions 7.0.41 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.42:*:*:*:*:*:*:* Versions 7.0.42 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.43:*:*:*:*:*:*:* Versions 7.0.43 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.44:*:*:*:*:*:*:* Versions 7.0.44 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.45:*:*:*:*:*:*:* Versions 7.0.45 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.46:*:*:*:*:*:*:* Versions 7.0.46 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.47:*:*:*:*:*:*:* Versions 7.0.47 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.48:*:*:*:*:*:*:* Versions 7.0.48 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.49:*:*:*:*:*:*:* Versions 7.0.49 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:7.0.50:*:*:*:*:*:*:* Versions 7.0.50 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc1:*:*:*:*:*:* Versions 8.0.0 rc1 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc10:*:*:*:*:*:* Versions 8.0.0 rc10 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc2:*:*:*:*:*:* Versions 8.0.0 rc2 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.0:rc5:*:*:*:*:*:* Versions 8.0.0 rc5 Vulnerable ·Apache
  • cpe:2.3:a:apache:tomcat:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·Apache

Remediation

  • Fix · GHSA-xx68-jfcg-xmmf commons-fileupload:commons-fileupload (Maven) Fixed in 1.3.1 Advisory →
  • Fix · GHSA-xx68-jfcg-xmmf org.apache.tomcat:tomcat (Maven) Fixed in 8.0.3 Advisory →
  • Fix · GHSA-xx68-jfcg-xmmf org.apache.tomcat:tomcat (Maven) Fixed in 7.0.52 Advisory →

Red Hat 14 advisories

  • RHSA-2015:1009 Released 2015-05-14 · Red Hat rating Important
    Red Hat JBoss Portal 6.2.0 update
    • Red Hat JBoss Portal 6.2
  • RHSA-2014:0526 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat7-7.0.40-13_patch_02.ep6.el5, tomcat7-admin-webapps-7.0.40-13_patch_02.ep6.el5, tomcat7-docs-webapp-7.0.40-13_patch_02.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat7-7.0.40-9_patch_02.ep6.el6, tomcat7-admin-webapps-7.0.40-9_patch_02.ep6.el6, tomcat7-docs-webapp-7.0.40-9_patch_02.ep6.el6 +7
  • RHSA-2014:0525 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security update
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 5 Server tomcat6-6.0.37-19_patch_04.ep6.el5, tomcat6-admin-webapps-6.0.37-19_patch_04.ep6.el5, tomcat6-docs-webapp-6.0.37-19_patch_04.ep6.el5 +7
    • Red Hat JBoss Enterprise Web Server 2 for RHEL 6 Server tomcat6-6.0.37-27_patch_04.ep6.el6, tomcat6-admin-webapps-6.0.37-27_patch_04.ep6.el6, tomcat6-docs-webapp-6.0.37-27_patch_04.ep6.el6 +7
Show 11 more Red Hat advisories
  • RHSA-2014:0527 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat7 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0528 Released 2014-05-21 · Red Hat rating Moderate
    Red Hat JBoss Web Server 2.0.1 tomcat6 security update
    • Red Hat JBoss Web Server 2.0
  • RHSA-2014:0473 Released 2014-05-06 · Red Hat rating Moderate
    Red Hat JBoss Operations Network 3.2.1 update
    • Red Hat JBoss Operations Network 3.2
  • RHSA-2014:0459 Released 2014-04-30 · Red Hat rating Important
    Red Hat JBoss Fuse Service Works 6.0.0 security update
    • Red Hat JBoss Fuse Service Works 6.0
  • RHSA-2014:0452 Released 2014-04-30 · Red Hat rating Important
    Fuse ESB Enterprise/Fuse MQ Enterprise 7.1.0 update
    • Fuse ESB Enterprise 7.1.0
    • Fuse MQ Enterprise 7.1.0
    • Fuse Management Console 7.1.0
  • RHSA-2014:0429 Released 2014-04-23 · Red Hat rating Moderate
    tomcat6 security update
    • Red Hat Enterprise Linux Desktop Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +6
    • Red Hat Enterprise Linux Server (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Workstation (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-el-2.1-api-6.0.24-64.el6_5, tomcat6-jsp-2.1-api-6.0.24-64.el6_5 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) tomcat6-6.0.24-64.el6_5, tomcat6-admin-webapps-6.0.24-64.el6_5, tomcat6-docs-webapp-6.0.24-64.el6_5 +2
  • RHSA-2014:0400 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss Fuse 6.1.0 update
    • Red Hat JBoss Fuse 6.1
  • RHSA-2014:0401 Released 2014-04-14 · Red Hat rating Moderate
    Red Hat JBoss A-MQ 6.1.0 update
    • Red Hat JBoss A-MQ 6.1
  • RHSA-2014:0373 Released 2014-04-03 · Red Hat rating Moderate
    Apache Commons Fileupload and JBoss Web security update
    • Red Hat JBoss BPMS 6.0
    • Red Hat JBoss BRMS 6.0
  • RHSA-2014:0252 Released 2014-03-05 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 security update
    • Red Hat JBoss Enterprise Application Platform 6.2
  • RHSA-2014:0253 Released 2014-03-05 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 6.2.1 security update
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 Server jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el5
    • Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 Server jbossweb-7.3.0-2.Final_redhat_2.1.ep6.el6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix yet
Red Hat Enterprise Linux 5Affected—
Red Hat JBoss BRMS 5AffectedNo fix planned: Will not fix
Red Hat JBoss BRMS 6AffectedNo fix yet
Red Hat JBoss Enterprise Web Server 1AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse Service Works 6AffectedNo fix yet
Red Hat JBoss Operations Network 3AffectedNo fix yet
Red Hat JBoss Portal 4AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 5AffectedNo fix planned: Will not fix
Red Hat JBoss Portal 6AffectedNo fix yet
Red Hat JBoss SOA Platform 4AffectedNo fix planned: Will not fix
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Red Hat Software CollectionsAffectedNo fix yet
Fuse ESB Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse MQ Enterprise 7.1.0Fixed RHSA-2014:0452
Fuse Management Console 7.1.0Fixed RHSA-2014:0452
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2014:0429
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2014:0429
Red Hat JBoss A-MQ 6.1Fixed RHSA-2014:0401
Red Hat JBoss BPMS 6.0Fixed RHSA-2014:0373
Red Hat JBoss BRMS 6.0Fixed RHSA-2014:0373
Red Hat JBoss Enterprise Application Platform 6.2Fixed RHSA-2014:0252
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 5 ServerFixed RHSA-2014:0253
Red Hat JBoss Enterprise Application Platform 6.2 for RHEL 6 ServerFixed RHSA-2014:0253
Red Hat JBoss Enterprise Web Server 2 for RHEL 5 ServerFixed RHSA-2014:0525, RHSA-2014:0526
Red Hat JBoss Enterprise Web Server 2 for RHEL 6 ServerFixed RHSA-2014:0525, RHSA-2014:0526
Red Hat JBoss Fuse 6.1Fixed RHSA-2014:0400
Red Hat JBoss Fuse Service Works 6.0Fixed RHSA-2014:0459
Red Hat JBoss Operations Network 3.2Fixed RHSA-2014:0473
Red Hat JBoss Portal 6.2Fixed RHSA-2015:1009
Red Hat JBoss Web Server 2.0Fixed RHSA-2014:0528
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss Data Grid 6
  • Red Hat JBoss Data Virtualization 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2014-0050
  2. 2026-10-03 Alias added: GHSA-xx68-jfcg-xmmf
  3. 2026-10-07 CVSS score added · CISA ADP
  4. 2026-10-07 Weakness changed · CISA ADP
  5. 2026-10-07 CISA SSVC decision points changed

References

Exploit 1

Patch 3

Advisory 12

Other 45

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences